Mattias Pilroth | OT Security Architecture

Compliance Has a Working Range

Sun, 13 Sep 2026 00:00:00 +0000

A plant that is run by a control system can be driven by that control system. Whatever the plant can be commanded to do, it can be commanded to do by whoever holds the commands, however they came to hold them.

Two questions follow, and they get treated as one.

The first is what it takes to keep the commands in the right hands: to manage known vulnerabilities as fixes are published for them, to separate what should not be reachable, to govern who holds credentials, and to be able to recover when something fails. This is what the discipline is organised around. It is structured by compliance frameworks, audited on a cycle, and it does real work.

Independence Cannot Be Discounted

Tue, 01 Sep 2026 00:00:00 +0000

Where a configuration authority can create the initiating demand and defeat the credited safety instrumented function in the same causal sequence, that function is not an independent protection layer against that cause. Its integrity level does not entitle it to partial credit there, and a probability derived from the security measures in place is not a substitute, because it describes a different conditional event. This paper does not establish, for any particular installation, that such an arrangement exists.

Sequenced OT Resilience: A Framework for Consequence-Derived Investment

Thu, 14 May 2026 00:00:00 +0000

Editorial note, October 2026: this paper will be withdrawn when the method document that succeeds it is published. It proposed a staged framework: first establish whether an unacceptable outcome is bounded, then work through every pathway on the site, removing what is not needed and relying on the boundaries that remain, so that the systems behind them needed less of the ordinary programme of their own. The first stage continues in the method document. The later stages have been revisited. Relying on a boundary in place of the controls behind it means keeping that boundary true through every vendor visit, project and maintenance window. Whether that is worth the cost depends on how often that part of the site changes: a boundary around systems left untouched for a decade is a different proposition from one crossed by every project. Where an outcome the operator cannot accept depends on the boundary, the cost has to be carried either way. Removing what is not needed is still worth doing, and elsewhere the ordinary programme continues. The question the first stage answers is set out in Compliance Has a Working Range.

The Coverage Trap

Sun, 29 Mar 2026 00:00:00 +0000

Editorial note, October 2026: this paper has been withdrawn.

The Coverage Trap argued that control coverage had become the governing unit of OT security investment. Programmes counted deployed controls, and the count said little about whether the exposures that mattered had moved. The paper proposed an alternative built on verified boundaries, relied on in place of much of the ordinary programme.

That conclusion has been revisited. Coverage has real limits, but like an estimate of how likely an attack is, it is the only stand-in available for a reduction nobody can measure. Wherever a wrong answer costs a loss the operation can recover from, the programme it measures is the right instrument. The proposed alternative asked a site to keep every boundary true through every change, which is the discipline of a safety system applied to a whole site.

Silent Degradation in OT Systems

Sun, 22 Mar 2026 00:00:00 +0000

Long-lifecycle OT systems do not hold their commissioning state.

Sustained operation is not evidence of operational stability.

These systems drift. Configuration diverges from documentation. Temporary changes become permanent. Redundant paths fail one at a time without crossing the threshold that forces escalation. Diagnostic channels decay. Ownership weakens at the interfaces between systems, teams, and vendors. The environment continues to run while its actual condition moves away from the condition operators believe they are maintaining.

Why OT Infrastructure Appears Static

Sun, 22 Feb 2026 00:00:00 +0000

Industrial control systems in chemical plants, refineries, and generating stations appear static to IT and cybersecurity teams. Systems stay in service for decades. Patch levels lag. Legacy platforms outlive vendor support. Change is slow and frequently deferred.

From outside the operating context, this looks irrational. Inside the fence, it is a rational response to consequence, liability, validation limits, and funding mechanics. The inertia follows from the constraints that determine what change the plant can safely absorb.